Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

blueteam

Étoiles3

Forks1

Mis à jour23 juin 2026 à 04:04

Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

GovAlta

GovAlta/COMMON-HARNESS

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	blueteam
description	Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam                          # Assess ./app/ with full pipeline
/blueteam --target /path/to/app    # Assess a different target
/blueteam --step 5                 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step	Skill	File
1	Load preflight	`.claude/security/blueteam/shared/skills/preflight.md`
2	Application map	`.claude/security/blueteam/skills/01-application-map.md`
3	Security classification	`.claude/security/blueteam/skills/02-security-classification.md`
4	Security architecture (optional)	`.claude/security/blueteam/skills/03-security-architecture.md`
5	Threat model	`.claude/security/blueteam/skills/04-threat-model.md`
6	ASVS Level 2 assessment	`.claude/security/blueteam/skills/05-asvs-level2-assessment.md`
7	CAS compliance	`.claude/security/blueteam/skills/06-cas-compliance.md`
8	Kill chain aggregation	`.claude/security/blueteam/skills/07-kill-chain-aggregator.md`
9	Deterministic tool scans (MANDATORY)	`.claude/security/blueteam/skills/08-tool-scanning.md`
10	Security unit tests	`.claude/security/blueteam/skills/09-security-unit-tests.md`
11	DR resilience	`.claude/security/blueteam/skills/10-dr-resilience.md`
12	Code fix generation (optional)	`.claude/security/blueteam/skills/11-code-fix-generation.md`
13	Requirements map	`.claude/security/blueteam/skills/13-requirements-map.md`
14	Overview report (FINAL)	`.claude/security/blueteam/skills/12-security-overview-report.md`

For each step:

Read the skill .md file for instructions
Perform the AI-driven analysis
Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam

# Run all security scans
node scripts/security-pipeline.js --repo-root /path/to/target --all

# Generate HTML reports
node scripts/generate_report_html.js --repo-root /path/to/target
node scripts/generate_overview_html.js --repo-root /path/to/target
node scripts/generate_requirements_report.js --repo-root /path/to/target
node scripts/generate_code_changes_report.js --repo-root /path/to/target

# Validate
node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets
Use [REDACTED-*] placeholders for credential values
Do not modify application source code during assessment
All HTML reports must be script-generated, never hand-crafted

Plus depuis ce dépôt

même dépôt

build

GovAlta/COMMON-HARNESS

Scaffold and build an app from the harness's template. Copies template/public into ./app/, optionally strips unused code, and follows the build guides. Sole sanctioned scaffold path — never build by hand.

2026-06-233

greenteam

GovAlta/COMMON-HARNESS

Run a green team deterministic code review against a target codebase, multi-round static and dynamic analysis (Round 1: npm audit, secrets, dangerous patterns, dependencies, licences, circular imports, formatting, govulncheck, OpenAPI lint, gitignore, env defaults, migrations, compiled binaries, API baseURL audit, Go toolchain; Round 2: type checking, ESLint, vitest coverage, go test coverage, integration test enumeration, test-bypass audit, CI pipeline audit, console-log scan, refinement re-framing). Mirrors the blueteam / redteam pipeline shape. Modeled on real human-led code reviews. Usage: /greenteam [--target /path/to/repo] [--round 1|2|all]

2026-06-233

phase1-requirements

GovAlta/COMMON-HARNESS

Phase 1 of the build lifecycle. Read every input under ./phases/phase1-requirements/inputs/, classify and analyze each document, and produce a structured FR/NFR/module-decomposition deliverable at ./phases/phase1-requirements/output/requirements.md. Usage: /phase1-requirements [--module moduleName]

2026-06-233

phase2-planning

GovAlta/COMMON-HARNESS

Phase 2 of the build lifecycle. Read the requirements deliverable from ./phases/phase1-requirements/output/requirements.md, then produce a highly structured plan: roadmap, task breakdown, dependency graph, estimates, critical path, resource plan, and risks. Hard-blocks if requirements.md is missing. Usage: /phase2-planning [--module moduleName]

2026-06-233

phase3-architecture

GovAlta/COMMON-HARNESS

Phase 3 of the build lifecycle. Read requirements.md and plan.md from prior phase outputs, then produce a structured architecture deliverable: system context, components, data model, API contract, auth flow, deployment topology, tech stack (aligned with template/), ADRs, NFR-to-component mapping, and a STRIDE-lite threat model. Hard-blocks if either prior artifact is missing. Usage: /phase3-architecture [--module moduleName]

2026-06-233

phase4-prototyping

GovAlta/COMMON-HARNESS

Phase 4 of the build lifecycle. Build a thin end-to-end tracer-bullet slice that validates the architecture's headline assumptions BEFORE committing the full plan to them. Hard-blocks if architecture.md is missing. Produces a working prototype + prototype-report.md (validations confirmed, assumptions falsified, performance baseline, architecture revisions proposed). Usage: /phase4-prototyping [--module moduleName]

2026-06-233

Blue Team Security Assessment

Run the full defensive security assessment pipeline against ./app/.

Usage

/blueteam # Assess ./app/ with full pipeline /blueteam --target /path/to/app # Assess a different target /blueteam --step 5 # Resume from step 5 (ASVS assessment)

Prerequisites

cd .claude/security/blueteam && npm install

Pipeline

Execute these steps in order. Read .claude/security/blueteam/CLAUDE.md for the full protocol.

Step

Skill

File

Load preflight

.claude/security/blueteam/shared/skills/preflight.md

Application map

.claude/security/blueteam/skills/01-application-map.md

Security classification

.claude/security/blueteam/skills/02-security-classification.md

Security architecture (optional)

.claude/security/blueteam/skills/03-security-architecture.md

Threat model

.claude/security/blueteam/skills/04-threat-model.md

ASVS Level 2 assessment

.claude/security/blueteam/skills/05-asvs-level2-assessment.md

CAS compliance

.claude/security/blueteam/skills/06-cas-compliance.md

Kill chain aggregation

.claude/security/blueteam/skills/07-kill-chain-aggregator.md

Deterministic tool scans (MANDATORY)

.claude/security/blueteam/skills/08-tool-scanning.md

Security unit tests

.claude/security/blueteam/skills/09-security-unit-tests.md

DR resilience

.claude/security/blueteam/skills/10-dr-resilience.md

Code fix generation (optional)

.claude/security/blueteam/skills/11-code-fix-generation.md

Requirements map

.claude/security/blueteam/skills/13-requirements-map.md

Overview report (FINAL)

.claude/security/blueteam/skills/12-security-overview-report.md

For each step:

Read the skill .md file for instructions

Perform the AI-driven analysis

Write structured findings to the target's .ai/data/ and .ai/reports/ directories

Mandatory Deterministic Scans (Step 9)

AI analysis alone is NEVER sufficient. Run these scripts:

cd .claude/security/blueteam # Run all security scans node scripts/security-pipeline.js --repo-root /path/to/target --all # Generate HTML reports node scripts/generate_report_html.js --repo-root /path/to/target node scripts/generate_overview_html.js --repo-root /path/to/target node scripts/generate_requirements_report.js --repo-root /path/to/target node scripts/generate_code_changes_report.js --repo-root /path/to/target # Validate node scripts/validate_reports.js --repo-root /path/to/target

Safety Rules

Do not read .env files or production secrets

Use [REDACTED-*] placeholders for credential values

Do not modify application source code during assessment

All HTML reports must be script-generated, never hand-crafted